Bug 2058640 (CVE-2022-26126) - CVE-2022-26126 frrouting: Misusing strdup leads to stack overflow in isis_nb_notifications.c
Summary: CVE-2022-26126 frrouting: Misusing strdup leads to stack overflow in isis_nb_...
Keywords:
Status: NEW
Alias: CVE-2022-26126
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Nobody
QA Contact:
URL:
Whiteboard:
Depends On: 2072474 2072475 2072476
Blocks: 2058651
TreeView+ depends on / blocked
 
Reported: 2022-02-25 14:13 UTC by Pedro Sampaio
Modified: 2023-07-07 08:35 UTC (History)
3 users (show)

Fixed In Version: frrouting 8.2
Doc Type: If docs needed, set a value
Doc Text:
frrouting is vulnerable to a flaw that can cause stack overflow due to processing binary data as simple string data. Since c string data is not being processed when processing packets , correct binary aware functions should be used. There is high impact to availability due to the fact that the process up-time can be made unreliable.
Clone Of:
Environment:
Last Closed:
Embargoed:


Attachments (Terms of Use)

Description Pedro Sampaio 2022-02-25 14:13:37 UTC
Buffer overflow vulnerabilities exist in FRRouting through 8.1.0 due to the use of strdup with a non-zero-terminated binary string in isis_nb_notifications.c.

Upstream bug:

https://github.com/FRRouting/frr/issues/10505

Comment 1 devthomp 2022-04-06 11:28:07 UTC
Created frr tracking bugs for this issue:

Affects: fedora-all [bug 2072476]


Note You need to log in before you can comment on or make changes to this bug.